Aadhaar: one number for a billion people

Aadhaar is twelve digits, issued at random, carrying no information about the person who holds it. That is deliberate, and it is why the number is easy to describe and hard to argue with: not a caste certificate, not a birth record, not an address. An index.

The problem it was built for was narrower than identity in general. For two decades welfare reached people through documents — a ration card, a pension order, a below-poverty-line list — and a document is a claim, not a fact. One household could hold ration cards in two districts. A dealer could keep a register of names that did not exist. None of this required a corrupt senior official; it required only that nobody could answer, cheaply and at scale, whether this was the same person.

The wager was that if identity itself became the check, the leak would close where it opened.

One person, one number

Enrolment collects a name, an address, a date of birth, ten fingerprints, two iris scans and a photograph. The prints and irises are not stored as images to be compared at a counter. They become templates, and at enrolment those templates are checked against every record already held. If they collide, no new number is issued. That is de-duplication, the one place where the uniqueness of a person is actually established.

What changed is the direction of the check. In the old arrangement a local registrar decided, and the registrar had a reason to say yes. Aadhaar moved that decision to a database with no relationship to the applicant: the question stopped being "do I believe you" and became "does this template collide with any of the 1.3 billion already stored". A number is issued once and never re-assigned.

The record behind the number carries the data: name, address, phone, and on request a photograph and an iris code. The number is only a pointer, which is why it does not need to be secret — knowing someone's number gets you nothing without the biometric or the one-time code.

The answer is yes or no

Authentication is the operating half. A requesting agency — a ration shop, a bank, a telecom operator — sends the number with a fingerprint, an iris scan or a one-time code. The central system returns a yes or a no. Not a score, not a confidence level, not a probability. Either the biometric matches the template held against that number, or it does not.

This is a choice with a consequence: the system cannot represent a partial match. There is no threshold at which someone is 87 per cent the right person and the entitlement is released pro rata. One bit comes out, so every ambiguity has to be resolved on one side of it.

The legal architecture attaches that bit to delivery. Section 7 of the Aadhaar Act allows the government to require Aadhaar for a subsidy or service funded from the Consolidated Fund, and everything built on it inherits the same answer: the ration shop, cash transfers for wages and pensions, bank account opening, mobile SIM activation. A bank opens an account on Aadhaar alone, because the yes substitutes for an address proof and a photograph; a ration shop dispenses against a central register rather than a state list.

Two ledgers

The case for the gate can be stated in numbers the gate produced. Duplicate enrolments are rejected at source. Ration cards seeded to Aadhaar can be matched against death records and migration. Ministries have put the number of cards deleted after seeding in the tens of millions. These are administrative claims rather than audited findings, and the size is disputed; the direction is not. A register that could not be reconciled with itself became reconcilable.

The case against is harder to state in numbers, because the people it concerns are, by construction, no longer in the register. A fingerprint worn smooth by thirty years of manual work, or an iris scan taken in direct sunlight at an outdoor camp, will not match. A name spelled one way on a ration card and another way on a passbook will pass the biometric and fail the seeding. An address that changed after marriage breaks the link to the money.

None of these people are ineligible. They are people for whom the gate returned the wrong bit, and the gate cannot tell the difference, because the wrong bit is the same bit.

The appeal is the blind spot

Put the running cost of the system beside the cost of one failure. The state's cost of a false negative is, in accounting terms, zero: the payment is not made and the ledger balances. The individual's cost is the benefit itself, plus the fare to the enrolment centre, plus the day's wage, plus however many trips the correction takes. A name correction needs a proof of identity and a proof of address — precisely the documents that were unreliable in the first place, or the person would not have needed the number.

This is not a defect a better app would fix. It is a property of putting a binary check in front of an entitlement. Verifying at the point of delivery moves the burden of proof to the moment of use, when a person has the least time, the least paperwork and the least leverage. The old system failed by paying the wrong person; the new one fails by not paying the right one. Both are leaks, but only the first shows up in the accounts.

It is also worth noticing what the scorecard is. UIDAI publishes enrolments and authentication transactions, both large and rising. It does not publish, and could not easily publish, the number of people who stopped trying.

What the courts changed, and what they could not

In August 2017 a nine-judge bench held unanimously that privacy is a fundamental right, which meant the scheme had to be justified rather than merely authorised. In September 2018 a five-judge bench upheld the Act and drew the boundary the design had left open: Section 57 was struck down, so private companies could no longer demand Aadhaar as a condition of service; the requirement to link existing bank accounts and mobile numbers was struck down; subsidies and benefits under Section 7 survived, and so did the link to the income-tax return and the PAN. No benefit could be denied for want of a number.

Read as instructions to a system, the judgments did three things: they limited who may ask, they limited what may be asked for, and they required that a person who fails authentication has another route. What they could not do is make that route cheap. A court can order an alternative; it cannot staff the counter, shorten the queue or refund the bus fare. Proportionality lands on the statute, and the friction lands on the person.

What is left is a ledger with two columns measured differently. Duplicate identities removed, payments reaching a named individual, a register that reconciles — counted by the agency that built the system. People who exist, who are entitled, and who cannot produce the one thing the system accepts as evidence of it — counted by researchers, occasionally, in the districts they can reach. A verification system is judged by the errors it removes; the errors it creates are carried by people who have dropped out of the dataset.

This is one of the Modern India entries in About India.